
12/19/2003 17:06 



9723672002 



CYC 



PAGE 10 



REMARKS 



Claims 1-34 are pending in the present application. No amendments to the claims 
are made by this Response. Reconsideration of the claims is respectfully requested. 

I. 35 U.S.C. 8 102. Alleged Anticipation, Claims 1-34 

The Office Action rejects claims 1-34 under 35 U.S.C. § 102(e) as being allegedly 
anticipated by Cooper et al. (US 2001/0051996 Al). Because this rejection is essentially 
the same as in the previous Office Action, this rejection is respectfully traversed for the 
same reasons stated in the previous Response filed October 9> 2003, the remarks of which 
are hereby incorporated by reference. The following remarks are provided in rebuttal of 
the Examiner's statements in the present Office Action beginning on page 2, section 2 of 
the Final Office Action. 

In the October 9, 2003 Response, Applicants argued that the Cooper reference 

does not teach, with respect to claim 1, which is representative of the other rejected 

independent claims 11, 12, 14 and 24, receiving a request to remove selected information 

from the stored information from a user within the set of users-, wherein the selected 

information is received in response to a transaction involving the user. In response, the 

Examiner, on page 2 of the present Office Action states the following: 

In the Telephone interview of 10/17/03 and in the Response, 
Applicants attempt to draw distinction between revoke and remove. 
Firstly, there i$ no evidence in the Disclosure that the removal of data 
from memory means anything other than the usual removal of access, 
which would allow garbage collection processes to reclaim the memory 
space. Secondly, Webster's New Riverside University Dictionary 
Houghton Mifflin Company, ©1984, 1988, defines revoke as meaning to 
nullify by withdrawing, recalling or reversing. There is no obligation of 
the revoking authority to re-instatc, and thus revocation is equivalent to 
removal. 

Applicants correctly states that patentability depends on each and 
every element of a claim, but then argues claims 2-7 in terms of element 2, 
whereas claims 3-7 depend directly on claim 1 and do not include that 
element. (The arguments concerning claims 8-26 are included in this 
analysis.) New claims 27-34 are addresses below. 
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As to claim 1, Applicant states [page 1 1] that Cooper does not 
teach receiving a request to remove selected information, received from a 
user in response to a transaction involving the user. To reiterate the 
rejection. Cooper is directed to transactions in which a user, who obtains a 
digital certificate which allows access to content selected by the user. 
[See also 001 8i 0060 lines 6-9.] Of course this is done by some 
management system, but so arc the steps of the claims, and a user request 
is required to trigger the process. As noted at [0065], any entity may act as 
the certification authority that revokes a user's digital certificate [0069], 
Again, such an act cannot be arbitrary, but inherently must be initiated by 
request, which is itself a transaction in the system* 

Applicant respectfully disagrees that Applicants' disclosure contains no evidence 

that the removal of data from memory means anything other tlian the usual removal of 

access. To the contrary, throughout the present description it is stated that the present 

invention's whole intent is to provide a user with the ability to "remove" their personal or 

confidential information from a server. For example, this is referred to on page 4, lines 

12-1 8; page 1 2, lines 25-28; page 20, lines 7-10 and elsewhere. One example section of 

the present specification that provides support for removal of selected information is 

found at least on page 14, lines 6-18 of the specification, which reads as follows: 

A user may identify personal or confidential information sent to server 
400 through security process 414. A request may be generated and sent to 
server 400 to remove this information. The request is received by Web 
server 406 and sent to security process 43 2 for handling. If the 
information is no longer required for a particular transaction, security 
process 412 removes the information from client information database 
410. A confirmation is then returned to the user at client 402, indicating 
that the information h as been removed. If the information is still required 
for the transaction, such a notice is returned to the user. 

This section of the Applicants' specification provides adequate disclosure that a 
user identifies personal or confidential information that is intended for removal, a request 
is received to remove the information and, if the information is no longer required, the 
information is removed from the client information database. The whole reason for the 
present invention is to remove information from a server so that it is no longer accessible 
by the server. This is clear from the many sections of the disclosure referenced above 
and many other portions of the disclosure that are not explicitly pointed to above. The 
only way in which information may be removed from a server, so that it is no longer 
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accessible by the server, is to completely remove the information, such as by completely 
deleting thi$ information from the server. Simply "revoking" information does not 
achieve this purpose. 

In determining the scope of a term in the claims, the Examiner must look to both 
the intrinsic evidence provided in the disclosure and may, when the intrinsic evidence is 
considered not sufficient, consider extrinsic evidence provided by other sources. As 
d iscussed above, the intrinsic provided when readi ng the claims in vi ew of the 
specification makes it clear that the term "remove" means to completely delete or "get rid 
of 1 the information so that it is no longer accessible by in the stored information. This is 
clear from page 20, lines 7-10, which state that the particular mechanism of the present 
invention is used for "removing traces of personal or confidential information, such as a 
credit card number or a social security number." Removing traces of personal or 
confidential information means to completely remove or delete this information so that it 
is not accessible by the server. Simply "revoking" information would not remove all 
traces of personal or confidential information. In fact, "revoking" leaves the information 
but revokes the ability to use the information. Thus, traces of the personal or confidential 
information are still present when the information is simply "revoked. 1 * 

Moreover, other sections of the specification make it clear that the complete 
removal so that there is no accessibility to the information is intended by the term 
"remove." For example, Figure 1 1 and page 1 9, lines 1 4-17 state that "removal of the 
confidential information from the database may not occur if the confidential information 
is still required for the transaction." It is clear from this statement that i f the information 
is removed, the server would not be able to complete the transaction because the 
information is no longer present. If the information were simply "revoked", the 
transaction could complete and then the information not be used again but still be present 
in the server. Therefore, again "removal" is not the same as "revoking." 

Thus, the intrinsic evidence found within the disclosure clearly points to the term 
"revoke" meaning to completely remove or delete $o that the information is no longer 
present in the stored information. Moreover, Applicants 1 own arguments have limited the 
definition of the term "remove" to have this definition and to not include simply 
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"revoking" the information. Therefore, the Examiner should interpret the term "remove* 1 
in the manner asserted by Applicants. 

However, if the intrinsic evidence and Applicants* arguments are not considered 
to be sufficient, the extrinsic evidence also points to the term "remove" being difference 
and non-synonymous with "revoke," The term "remove" is defined by Webster's 
Dictionary, Random House Inc., ©1996, 1993 as meaning "to do away with" or 
"eliminate." The Examiner's provided definition of "revoke" is contrary to the definition 
of "remove". The Examiner states that the definition of the term "revoke" is "to nullify 
by withdrawing, recalling or reversing" as per Webster's New Riverside University 
Dictionary, Houghton Mifflin Company, ©1984, 1988. It is conspicuous that the 
Examiner's own definition of "revoke" does not mention "removing" and the term 
"remove" is not identified by Webstcrs as a synonym of "revoke." This is because 
"nullifying" is not the same as "removing." The term "nullify" means to invalidate, not to 
completely remove or delete so that there is no trace of the information left, as with the 
term "remove." Furthermore, Applicants respectfully submit that neither "revoke" nor 
"remove" are synonyms of each other as per Roget's II, The New Thesaurus, Houghton 
Mifflin Company, © 1980. 

Moreover, Applicants respectfully disagree with the Examiner's statement that 
"There is no obligation of the revoking authority to re-instate, and thus revocation is 
equi valent to removal," Nowhere in Cooper is it taught that revocation of a user's digital 
certificate is equivalent to removal. To the contrary, Cooper teaches that the digital 
certificate must be retained for further investigation at paragraph [0148], which reads as 
follows: 

[0148] For this reason, other security precautions may be taken. 
The CPS may additionally contain a password that must be correctly 
matched by the legitimate consumer at the time the hardware device 
containing the digital certificate logs on to the VPN. If an attempt to enter 
the password fails more than a predetermined number of times, the digital 
certificate may be immediately revoked by the Authenticate User and Get 
Digital Certificate step 320 until a further investigation may be conducted , 
(emphasis added) 

This section of Cooper teaches that if an invalid password is entered too many 
times the digital certificate is revoked until a further investigation may be conducted . If 
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Cooper were to teach as the Examiner alleges, "revocation is equi valent to removal", then 
Cooper would not be able to investigate the in valid use of the password tied to the digital 
certificate as it would no longer exist. Thus, Cooper does not teach removal of client 
information from the client information database in response to a request from a user, 
which identifies personal or confidential information that is intended for removal. 

Furthermore, the revocation of the digital certificate as taught by Cooper is in 
response to an invalid password being entered is not a request from a user to remove 
selected information from the stored information of a user in response to a transaction 
involving the user. The revocation of the digital certificate is not an intended request to 
remove information about the user. Additi onally, as shown above, if the entry of an 
invalid password were intended to remove information about the user, the teachings of 
Cooper would not perform the desired function. That is, the use of an invalid password 
by the user would result in the user no longer being able to access the information, but the 
information about the user is still in the stored information of the Cooper system. 

Thus, in view of the above, Applicants respectfully submit that Cooper does not 
teach each and every feature of independent claims 1,11, 12, 14 and 24 as is required 
under 35 LLS.C § 102(e). As independent claims 8, 13, 21 and 25 recites features similar 
to those in claims 1, 1 1, 1 2, 14 and 24, Applicants respectfully submit that Cooper does 
not teach each and every feature of independent claims 8, 13,21 and 25 as is required 
under 35 U.S.C § 102(e). At least by virtue of their dependency on claims 1, 8, 14, 21 
and 25, respectively, Cooper does not teach each and every feature of dependent claims 
2-7, 9, 10, 15-20, 22, 23 and 16-34. Accordingly, Applicants respectfully request 
withdrawal of the rejection of claims 1-34 under 35 U,S.C § 102(c). 

Additionally, in regard to the dependent claims, in the previous Response dated 

October 9, 2003, Applicants submit that claim 2 was argued as an example of the other 

dependent claims 3-7. As stated in the previous response; 

For example , with regard to claims 2, Cooper does not teach 
determining whether the request is a valid request and preventing 
removing of the selected information in response to a determination that 
the request is an invalid request, (emphasis added) 
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To further exemplify that Cooper does not teach the features of claims 2-7, claim 
3 recites that at least one of a certificate, a password, and a key is used to determine 
whether the request, which is a request to remove selected information from the stored 
information from a user within the set of users, is valid. As shown above, Cooper teaches 
away from removing information about a user and instead revokes the user's access to the 
information. Thus, Cooper does not teach validating a request to remove selected 
information from stored information based on at least one of a certificate, a password, 
and a key. 

As a further example, claim 7 recites the request sent to the user is in a form of an 
applet requesting personal information about the user. The Examiner stated on the 
previous Office Action dated July 1 1, 2003 that "Cooper is intended to be used with the 
Internet, which typically applies applets within the Java language." Simply using the 
Cooper system with the Internet does not necessitate the use of applets. There are many 
server functions that are performed without using applets. For example, servlets may be 
used, HTML based forms, or a plurality of other tools may be used. Thus, simply stating 
that the Cooper system is "intended to be used with the Internet" does not sufficiently 
address the feature of an applet being used to request personal information about a user. 

Furthermore, as stated in the previous Response, the Examiner fails to address the 
specific features of claims 8-13, 21-23 and 25-26, and merely alleges, without any 
supported evidence, that these claims are rejected on the same basis as claims 1-7, even 
though they contain additional features. For example, claim 8 contains the feature of 
sending a Web page to a user at a client. Nowhere in the Final Office Action or the 
Office Action dated July 7, 2003, does the Examiner provide a specific section of the 
Cooper reference that teaches this feature. 

Additionally, the Final Office Action alleges that the feature of the request to 
remove selected information originates from a client device of the user, as recited in 
claims 27, 29, 31 and 33 is taught at paragraph [0058] and [0065], As shown above, 
Cooper docs not teach receiving a request to remove selected information from the stored 
information from a user within the set of users and instead revokes the user's access to 
the system in response to a user inputting the wrong password. As to dependent claims 
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28, 30, 32 and 34, they are dependent on independent claims 1, 8, 14 and 21, 
respectively, and overcome Cooper for the reasons shown above. 

Furthermore, Cooper does not provide any teaching, suggestion, or incentive to 
make the needed changes to reach the presently claimed invention. Cooper actually 
teaches away from the presently claimed invention because this cited reference teaches 
retaining all information regarding the user and simply revoking access to the 
information, opposed to receiving a request to remove selected information from the 
stored information from a user within the set of users, where the selected information is 
received in response to a transaction involving the user and responsive to receiving the 
request, and removing the selected information from the stored information, as in the 
presently claimed invention. Absent the Examiner pointing out some teaching or 
incentive to implement Cooper to receive a request to remove selected information from 
the stored information from a user within the set of users, where the selected information 
is received in response to a transaction involving the user and responsive to receiving the 
request, removing the selected information from the stored information as in the presently 
claimed invention, one of ordinary skill in the art would not be led to modify Cooper to 
reach the present invention when the reference is examined as a whole. Absent some 
teaching, suggestion, or incentive to modify Cooper in this manner, the presently claimed 
invention can be reached only through an improper use of hindsight using the Applicants' 
disclosure as a template to make the necessary changes to reach the claimed invention. 

Thus., in view of the above, Applicants respectfully submit that Cooper does not 
teach each and every feature of independent claims 1,8, 11-1 4, 21, 24 and 25 as is 
required under 35 U.S.C. § 102(e). At least by virtue of their dependency on claims 1, 8, 
14, 21 and 25, respectively, Cooper does not teach each and every feature of dependent 
claims 2-7, 9, 10, 15-20, 22, 23 and 16-34. Accordingly, Applicants respectfully request 
withdrawal of the rejection of claims 1-34 under 35 U.S.C. § 102(e). 
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II. Conclusion 

It is respectfully urged that the subject application is patentable over Cooper and 
is now in condition for allowance. The Examiner is invited to call the undersigned at the 
below-listed telephone number if in the opinion of the Examiner such a telephone 
conference would expedite or aid the prosecution and examination of this application. 



Respectfully submitted, 





Stephen JLWalder, Jr. * 
Reg. No. 41,534 
Carstens, Yee & Cahoon, LLP 
P.O. Box 802334 
Dallas, TX 75380 
(972)367-2001 
Attorney for Applicants 



Attachments: 



Webster's Dictionary;, page 561 
Random House Inc., ©1996, 1993 



Roget's II, The New Thesaurus, pages 376 and 386 
Houghton Mifflin Company, © 1980 



SJW/fl 
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